The United States has charged five individuals accused of orchestrating a sophisticated hacking scheme that targeted businesses, individuals, and cryptocurrency platforms. The group allegedly stole over $11 million in cryptocurrency and sensitive information, with one victim losing $6.3 million in a single breach.
How the Hack Was Carried Out
Prosecutors from the California U.S. Attorney’s Office revealed the group used SMS phishing attacks and SIM-swapping techniques to compromise victims’ accounts. These methods allowed them to steal login credentials for workplace systems and cryptocurrency wallets.
- SMS Phishing: Fake messages claimed accounts would be deactivated, tricking victims into clicking malicious links and revealing sensitive information.
- SIM Swapping: The attackers transferred victims’ phone numbers to their own devices, enabling them to bypass two-factor authentication systems.
Court documents detail 29 crypto theft victims and reveal the group targeted 45 companies across the U.S., Canada, India, and the U.K. One notable attack involved an unnamed U.S. crypto exchange, whose employees were tricked into sharing credentials through phishing links.
Details on the Defendants and Charges
The accused are alleged members of the hacking group “Scattered Spider,” which has been active since September 2021. The defendants are:
- Ahmed Elbadawy, 23, from Texas
- Noah Urban, 20, from Florida
- Evans Osiebo, 20, from Dallas
- Joel Evans, 25, from North Carolina
- Tyler Buchanan, 22, from Scotland
Each faces charges of conspiracy, conspiracy to commit wire fraud, and aggravated identity theft. Buchanan faces an additional charge of wire fraud, with fraud-related offenses carrying potential sentences of up to 20 years.
Links to Previous High-Profile Hacks
Scattered Spider is also linked to high-profile hacks, including the 2023 breaches of Caesars Entertainment and MGM Resorts. However, it is unclear if the five accused participated in these casino attacks. Prosecutors mentioned “other co-conspirators” and “unindicted co-conspirators,” indicating that more individuals may be involved.
How Authorities Tracked the Group
Investigators, including the FBI and Police Scotland, identified Buchanan through data he used to register phishing sites. A search of his devices uncovered information stolen from a U.S. cryptocurrency exchange and a telecom company.
Lawyers for the defendants have not yet been named, and the investigation remains ongoing. Officials, including U.S. Attorney Martin Estrada, emphasized the group’s impact, stating, “This group of cybercriminals perpetrated a sophisticated scheme to steal intellectual property and personal data belonging to hundreds of thousands.”
